G. Moser The Epsilon Calculus and 
R. Zach Herbrand Complexity 



Abstract. Hilbert's e-calculus is based on an extension of the language of predicate 
logic by a term- forming operator e x . Two fundamental results about the e-calculus, the 
first and second epsilon theorem, play a role similar to that which the cut-elimination 
theorem plays in sequent calculus. In particular, Herbrand's Theorem is a consequence 
of the epsilon theorems. The paper investigates the epsilon theorems and the complexity 
of the elimination procedure underlying their proof, as well as the length of Herbrand 
disjunctions of existential theorems obtained by this elimination procedure. 
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1. Introduction 

Hilbert's e-calculus jbl . Il6| is based on an extension of the language of 
predicate logic by a term- forming operator e x . This operator is governed by 
the critical axiom 

A{t) -» A{e x A(x)) , 

where t is an arbitrary term. Within the e-calculus, quantifiers become 
definable by 3xA(x) A(e x A(x)) and MxA{x) A(e x ->A(x)). 

The e-calculus was originally developed in the context of Hilbert's pro- 
gram of consistency proofs. Early work in proof theory (before Gentzen) 
concentrated on the e-calculus and the e-substitution method and was car- 
ried out by Ackermann P, |j| (see also 0] ) , von Neumann [24| , and Bernays 
Q (see also 0,0). The e-calculus is of independent and lasting inter- 
est, however, and a study from a computational and proof-theoretic point of 
view is particularly worthwhile. 

The aim of this paper is to present the central notions of and basic 
results about the e-calculus in a streamlined form and with attention to 
questions of proof complexity. This, we hope, will make the e-calculus more 
easily accessible to a broader audience, and will make clearer the merits and 
disadvantages of the e-calculus as a formalization of first-order logic. 

One simple example of the merits of the e-calculus is that by encoding 
quantifiers on the term-level, formalizing (informal) proofs is sometimes eas- 
ier in the e-calculus, compared to formalizing proofs in, e.g., sequent calculi. 
This is possible as the e-calculus allows more condensed representation of 
proofs than standard sequent- or natural deduction calculus. However, it 
should be pointed out that the encoding of quantifiers on the term-level can 
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come at a significant cost, as the transformation of quantified formulas may 
result in rather complicated term-structures. 

Hilbert's e-calculus is primarily a classical formalism, and we will restrict 
our attention to classical first-order logic. (But see the work of Bell 0, @|, 
DeVidi Q, Fitting 0, Mostowski [20| for a complementary view.) Our 
study is also motivated by the recent renewed interest in the e-calculus and 
the e-substitution method in, e.g., the work of Arai 0,0]) Avigad 0, and 
Mints et al., 0,E3- The e-calculus also allows the incorporation of choice 



construction into logic 

Our main focus will be the presentation and analysis of two conservativ- 
ity results for the e-calculus: the first and second e-theorems. Our proofs 
of these results are essentially those due to Bernays ,14], but we are also 
concerned with bounds on the length of proofs and the length of Herbrand 
disjunctions. Let T denote a finitely axiomatized open theory with axioms 
Pi, . . . , Pt containing no quantifiers or e-terms, and let PC £ be a usual 
formulation of the predicate calculus extended by the e-operator and its 
characteristic axiom. Then the first e-theorem states that any formula with- 
out quantifiers or e-terms provable in PC e from T is already provable from 
T in the quantifier- and e-free fragment EC of PC (the so-called elemen- 
tary calculus of free variables). The second e-theorem says that any formula 
without e-terms provable in PC e from T is also provable from T in PC, the 
pure predicate calculus. 

We prove the first e-theorem in Section 5. An important extension of 
the first e-theorem is the so-called extended first e-theorem, which yields 
one direction of Herbrand's theorem: if A is an existential formula provable 
in PC e , then there is a disjunction of instances of the matrix of A prov- 
able in EC. Call the minimal length of such a disjunction the Herbrand 
complexity HC(A) of A. We obtain an upper bound on HC(^4) by analyz- 
ing the complexity of the procedure used to eliminate critical formulas from 
the proof of A; this bound is hyperexponential in the number of quantifier 
axioms in the derivation of A. In Section 6 we show that there is also a 
hyperexponential lower bound on HC(^4), and thus the procedure for gen- 
erating the Herbrand disjunction based on Bernays's proof of the extended 
first e-theorem is essentially optimal. In Section 7, we prove the second e- 
theorem. Its proof also contains a proof of the second direction of Herbrand's 
theorem, i.e., that given a (valid) Herbrand disjunction of A, A is provable. 

In this paper we only consider the e-calculus without equality. The case 
of the e-theorems with equality is much more involved than the proofs we 
consider here, and cannot be dealt with adequately in the space available. It 
raises important and interesting issues for the suitability of formalisms based 
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on the epsilon calculus for automated theorem proving. The complexity of 
the epsilon theorems in the presence of equality will be the subject of future 
work. 

2. The Epsilon Calculus: Syntax 

The syntax of the epsilon calculus is essentially that of a standard first-order 
language. We will, however, frequently pass back and forth between different 
calculi formulated in slightly different languages. Let us first dispense with 
some pedantry: The language L(EC) of the elementary calculus consists of: 
(1) free variables: a, b, c, . . . , (2) bound variables: x, y, z, . . . , (3) constant 
and function symbols: /, g, h, . . .with arities ar(/), . . . , (4) predicate sym- 
bols: P, Q, R, . . . with arities ar(P), . . . , and the propositional connectives: 
A, V, — -i. The language L(PC) of the predicate calculus is L(EC) plus the 
quantifiers V, 3. The language L(EC e ) of the pure epsilon calculus is L(EC) 
plus the epsilon operator e. The language L(PC £ ) of the predicate calculus 
with epsilon is L(PC) together with e. 

We will distinguish between terms and semi-terms, and between formulas 
and semi-formulas. The definitions are: 

Definition 1. (Semi) terms, (semi) formulas, and sub-(semi)terms are de- 
fined as follows: 

1. Any free variable a is a (semi)term. Its only sub-(semi)term is a itself. 
It has no immediate sub-(semi)terms. 

2. Any bound variable a; is a semi-term. It has no sub-terms or immediate 
sub-(semi)terms. Its only sub-semiterm is x itself. 

3. If / is a function symbol with ar(/) = 0, then / is a (semi)term. Its 
only sub-(semi)term is / itself. It has no immediate sub-(semi)terms. 

4. If / is a function symbol with ar(/) = n > 0, and t±, t n are 
(semi)terms, then f(h, . . . ,t n ) is a (semi)term. Its immediate sub- 
semiterms are t±, . . . , t n , and its immediate sub-terms are those among 
t\, . . . , t n which are terms, plus the immediate subterms of those 
among t\, . . . ,t n which are not terms. Its sub-semiterms are f(t±, . . . ,t n ) 
and the sub-semiterms of t\, . . . , t n ; its subterms are those of its sub- 
semiterms which are terms. 

5. If P is a predicate symbol with ar(P) = n > 0, and t\, . . . , t n are 
(semi)terms, then P(t±, . . . ,t n ) is an (atomic) (semi) formula. Its im- 
mediate sub-semiterms are t\, t n . Its immediate subterms are 
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those among ti, . . . , t n which are terms, plus the immediate subterms 
of those among t\, . . . , t n which are not terms. Its sub- (semi) terms 
are the sub- (semi) terms of t±, . . . , t n . 

6. If A and B are (semi)formulas, then ->A, A A B, AV B and A — > B 
are (semi) formulas. Its (immediate) sub- (semi) terms are those of A 
and B. 

7. If A(a) is a (semi)formula containing the free variable a and x is a 
bound variable not occurring in A(a), then MxA(x) and 3x A(x) are 
(semi) formulas. Its (immediate) sub-(semi)terms are those of A{x). 

8. If A(a) is a (semi)formula containing the free variable a and x is a 
bound variable not occurring in A(a), then e x A(x) is a (semi)term. 
Its sub- (semi) terms are e x A(x) and the sub-(semi)terms of A(x). Its 
immediate sub- (semi) terms are those of A(x). 

Note that terms and formulas are just semiterm and semiformula which 
contain no bound variables without a matching V, 3, or e. We will call a 
semi-term of the form e x A(x) an e- expression, or, if it is a term, an e-term. 

The definition above does not allow a quantifier or epsilon binding a 
variable x to occur in the scope of another quantifier or epsilon which binds 
the same variable. In order for some substitutions of terms to result in 
well-formed formulas, it will often be necessary to rename bound variables. 
Conversely, we cannot assume that all epsilon terms of the same form oc- 
curring in a proof are syntactically identical. Hence we will (a) adopt the 
convention that bound variables must be renamed when substituting terms 
so as to avoid clashes of bound variables, and (b) we tacitly identify epsilon 
terms which differ only by a renaming of bound variables. Thus, if A(a) is 
a formula with free variable a, then A(e x A(x)) is a formula obtained from 
A(a) by replacing every indicated occurrence of a by an epsilon term result- 
ing from e x A(x) by renaming each bound variable y occurring in it so as to 
ensure that y does not appear in the scope of a quantifier or epsilon in A(a). 
For instance, if A(a) = 3yP(a,y), then e x A(x) = e x 3y P(x,y) contains the 
bound variable y, and a literal substitution for a in A(a) would result in 
3y P(e x 3y P(x,y),y), which is not well formed. The variable y must be 
renamed, e.g., thus: 3y P(e x 3z P(x, z),y). 

An instruction to replace every occurrence of an epsilon-term e in a 
formula or proof by some other term is to be understood as an instruction 
to replace every e-term equal to e up to renaming of bound variables; e.g., 
"replace e x 3y P{x,y) in the above formula by £" results in 3yP(t,y). It will 



The Epsilon Calculus and Herbrand Complexity 



5 



sometimes be useful to be explicit about substitutions of terms for variables. 
We will write A(a) {a <— t} to denote the result of replacing the indicated 
occurrences of a in A(a) by t. 

3. Axiomatization of the Epsilon Calculus 

Definition 2. The set of axioms AxEC(L) of axioms of the elementary 
calculus for a language L consists of all propositional tautologies in the 
language L. To obtain the set of axioms AxEC e of the pure epsilon calculus 
we add to AxEC(L(EC e )) all substitution instances of 

A(t) - A(e x A(x)) . (1) 

An axiom of the form (^Q) is called a critical formula. We say that the critical 
formula belongs to the e-term e x A{x). 

The set AxPC of axioms of the predicate calculus, and the set AxPC e 
of axioms of the extended predicate calculus consist of AxEC(L(PC)) and 
AxEC e , respectively, together with all instances of A(t) — * 3x A{x) and 
MxA{x) — > A(t) in the respective language. 

Definition 3. A proof in EC (EC e ) is a sequence A±, . . . , A n of formulas 
such that each Ai is either in AxEC (AxEC e ) or it follows from formulas 
preceding it by modus ponens, i.e., there are j, k < i so that A^ = Aj — > Ai. 

A proof in PC (PC e ) is a sequence A\, . . . , A n of formulas such that 
each Ai is either in AxPC (AxPC e ) or follows from formulas preceding it by 
modus ponens, or follows from a preceding formula by generalization, i.e., 
there is a j < i so that either Aj = B — > C(a) and Ai = B — > \/xC{x) or 
Aj = B(a) — * C and Ai = 3xB(x) — > C. In the latter case we also require 
that the free variable a does not occur in Ai or in any A^ with k > i. Such 
a variable a is called an eigenvariable. The restriction guarantees that each 
variable is only used as an eigenvariable in a generalization inference at most 
once. 

A formula A is called provable in EC (EC e , PC, PC e ) if there is a proof 
in EC (ECeps, PC, PC £ , respectively) which has A as its last formula. To 
indicate that A is provable in, say, EC e by a proof tt, we write EC £ \- n A. 

Definition 4. The size sz(tt) of a proof ir is the number of steps in tt. If 
tt is a proof in EC e or PC £ , we define the critical count cc(tt) of tt as the 
number of distinct critical formulas and quantifier axioms in tt plus 1. 
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4. The Embedding Lemma 

The epsilon operator allows the treatment of quantifiers in a quantifier-free 
system: using e-terms, it is possible to define 3x and Vx as follows: 

3xA(x) <^ A(e x A(x)) 
MxA(x) o A(s x ->A(x)) 

We define a mapping £ of semiformulas and semiterms in L(PC e ) to semi- 
formulas and semiterms in L(EC e ) as follows: 

f(h, ■ ■ ■ ,tn) £ = f(tl, ■ ■ ■ ,t £ n ) P(h, ■ ■ ■ ,t n ) e = P(tl, . . . ,t £ n ) 
x £ = x (A — >■ Bf = A £ -> B £ [e x A{x)} £ = e x A(x) 
a £ = a (Ay Bf = A £ V B £ {3x A{x)) £ = A £ {e x A{x 
(^A) £ = ^A £ (AAB) £ = A £ A B £ (VxA(x)) £ = A £ (e x ^A(x 

Example 5. Consider 

3x(P(x) V VyQ(y)) £ = 

= [P(x)VVyQ(y)} £ {x^e x [P{x)V\/yQ(y)] £ } 
[P(x) V Vy Q(y)] £ = P(x) V Q(ey^y)) 

ei 

= P(x)VQ(e y ^Q(y)) {x <- e x [P(x) V Q(e y ^Q(y))}} 



s 

£ ) 



e2 

P(e x [P(x) V Q(e y ^Q(y))]) V Q(e y ^Q(y)) 



ei 



e2 

Example 6. Consider 

[3x 3y A(x,y)] £ = 

= [3yA(x,y)} £ {x <- e x [3y A(x, y)} £ } 
[3yA(x,y)] £ = A(x,e y A(x,y)) 

e'(x) 

= A(x, e y A(x, y)){x <- e x A(x,e z A(x, z)) } 

e'(x) e 3 

= A(e x A(x, e z A(x, z)),e y A(e x A(x, e z A(x, z)),y)) 

v ' V * ' 

" v ' 

e 4 = e'(e3) 
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Lemma 7 (Embedding Lemma). If it is a PC £ -proof of A then there is an 
EC £ -proof ir £ of A £ with sz(7r e ) < 3 • sz(-7r) and cc(it £ ) < cc(7r). 

Proof. We show that for all proofs ir consisting of formulas Ai, . . . , A n , 
there is a proof ir £ containing A\ , . . . , A £ n (plus perhaps some extra formulas) 
of the required size and critical count. We proceed by induction on n. The 
case n = is trivial. Suppose the claim holds for the proof consisting of A\, 
. . . , A n , i.e., there is a proof ir* containing A\ , . . . , A e n , and consider the 
proof 7r = Ai, . . . , A n , A. If A is a propositional tautology, then A £ is also 
a propositional tautology. (Note that (-) £ leaves the propositional structure 
of A intact.) If A is a critical formula, then A £ is also a critical formula. In 
both cases, we can take ir £ to be ir* extended by A £ n . 

If A is an instance of a quantifier axiom, its translation A £ either is of 
the form 

[A(t) -> 3xA{x)] £ = A £ {t £ ) -> A e (e x A(a;) e ) , 
which is a critical formula, or is of the form 

[y xA (x) -> ^(t)] £ = A e (e x -.A(x)) -> ^ £ (t £ ) , 

which is the contrapositive of, and hence provable from, a critical formula. 
In the latter case, the size of the resulting proof increases by two additional 
steps. 

Now suppose A follows by modus ponens from Ai and Aj = Ai — > A. 
Since ir* contains A\ and A £ - = A\ — > A £ , adding A £ to tt* is also a proof. 

If A follows by generalization, i.e., A = B — > VxC(x) and Ai = B — > 
C(a) (where a satisfies the conditions on eigenvariables) , then by induction 
hypothesis the proof 7r* contains A\ = B £ ^> C(a) £ . Replacing a everywhere 
in 7T* by e x ^A(x) results in a proof containing 

[B -> VxC(x)] £ = B £ -> A £ ( £;E ^(x) £ ) . 

in place of A^eps. Similarly, if the last inference derives ^4 = 3x B(x) — > C 
from 5(a) — > C, by induction hypothesis 7r* contains B(a) £ — > C £ , and we 
obtain a proof of A £ by replacing a everywhere in ir* by e x B(x). ■ 

5. The First Epsilon Theorem 

We begin our discussion of the e-theorems by a detailed proof of the first 
e-theorem. This theorem states that if a formula E without quantifiers or 
epsilon is provable in the (extended) e-calculus, then it is already provable 
in the elementary calculus. In other words, the (extended) epsilon calculus 
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is conservative over the elementary calculus for elementary formulas. A 
relatively simple corollary of the first epsilon theorem is the extended first 
e-theorem, which is a version of Herbrand's theorem for prenex formulas. 
This section is dedicated to proofs of these results. The argument we use is 
essentially Bernays's which gives a procedure by which critical formulas 
in proofs of E are eliminated step- wise. We analyze the procedure and 
thereby obtain upper bounds on the complexity of the Herbrand disjunction 
obtained in the extended first e-theorem. These bounds are given in terms 
of the hyperexponential function 2®, defined by 2g = x and 2? +1 = 2 2 f . 

The proof will proceed by induction on the rank and degree and number 
of e-terms in critical formulas in the proof of E. Rank and degree are two 
measures of complexity of e-expressions: Degree applies to e-terms only, and 
measures the depth of nesting of e-terms. Rank, on the other hand, measures 
the complexity of cross-binding of e-expressions. 

Definition 8. The degree of an e-term is inductively defined as follows: 

1. If A{x) contains no e-subterms, then deg(e x A(x)) = 1. 

2. If ex, • • • , e n are all immediate e-subterms of A(x), then 



Definition 9. An e-expression e is subordinate to e x A(x) if e is a proper 
sub-semiterm of A{x) and contains x. 

Definition 10. The rank of an e-expression e is defined as follows: 

1. If e contains no subordinate e-expressions, then rk(e) = 1. 

2. If ex, • • • , e n are all the e-expressions subordinate to e, then 



deg(e x A(x)) = max{deg(ei), . . . , deg(e n )} + 1 . 



rk(e) = max{rk(ei), . . . , rk(e n )} + 1 . 



Example 11. First, consider the formula 



P(e x [P(x) V Q(e y ^Q(y))]) V Q(e y ^Q(y)) . 





Here, ei is the only immediate e-subterm of e2 and has no e-subterms itself, 
so deg(ei) = 1 and deg(e2) = 2. Neither ex nor e<i contains subordinate 
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e-expressions, hence rk(ei) = rk(e2) = 1. In 

[3x3yA(x,y)f = A(e x A(x,e z A(x, z)),e y A(e x A(x,e z A(x, z)),y)) , 

V * ' V v ' 



e3 contains no e-subterms, but e^ contains e% as a subterm, so deg(e3) = 
1 and deg(e4) = 2. On the other hand, e% contains the subordinate e- 
expression e z A(x,z), hence rk(e3) = 2. Since y does not occur in the scope 
of another e, contains no subordinate e-expressions, and rk(e4) = 1. 

Definition 12. Suppose tt is a proof in EC e . If e is an e-term belonging to 
a critical formula A(t) — > A(e) of tt, then we call e a critical epsilon term of 
7T, and rk(e) (deg(e)) the rank (the degree) of that critical formula. 

The rank rk(7r) of tt is the maximum rank of its critical formulas. The 
degree deg(-7r, r) of tt with respect to rank r is the maximum degree of its 
critical e-terms of rank r. The order o(tt, r) of tt with respect to rank r is 
the number of different critical e-terms of rank r. 

Lemma 13. Let ir be a EC £ -proof, let r = rk(7r) be the maximal rank of 
critical formulas in tt, and let e be a critical e-term of tt of maximal degree 
among the critical e-terms of rank r. 

Suppose that A(t) — > A(e) is a critical formula belonging to e and that 
B* = B(s) — > B(e y B(y)) is a critical formula in tt belonging to a different 
e-term e y B{y), and suppose C is the result of replacing e by t in B* . Then 
(a) if rk(B*) = r, then C and B* have the the same critical e-term e y B(y) 
belonging to them, and (b) rk(C) = rk(S*). 

Proof. We first consider and exclude a preliminary case. If the indicated 
occurrences of s (on the left-hand side) or the indicated occurrences of e y B(y) 
(on the right-hand side) lie inside e, replacing e by t would result in a formula 
which is not of the form of a critical formula. This, however, can never be 
the case. For suppose it were, i.e., suppose B(a) is of the form B'{e'{a)) 
and either e = e'(s) or e = e'(e y B(y)). If e = e'(s), the left-hand-side 
B(s) of the critical formula is of the form B'(e'(s)), and consequently the 
right-hand-side is B'(e'(e y B'(e'(y)))). Conversely, if e = e'(e y B(y)), then 
the right-hand-side B(e y B(y)) would be of the form B'(e'(e y B'(e'(y)))). In 
either case we have an e-term e'(a) which is of the same rank as e, since 
e = e'(t') for some term t'. (Note that by our conventions on renaming of 
variables, no subexpression of t' can be subordinate to e.) On the other 
hand, e'(y) is subordinate to the critical e-term e y B(y) = e y B'(e' (y)), and 
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so xk(e y B{y)) > rk(e'(y)) = rk(e). But e was assumed to be a critical e-term 
of maximal rank. 

There are then only two ways in which e can occur in a critical formula: 
either (i) e occurs only in the indicated occurrences of s but not in B(y) at 
all, or (ii) e occurs in B(y) (and perhaps also in s). 

Case (i): e occurs only in s, i.e., s = s'(e). Replacing e by t results in 
the critical formula C = B(s'(t)) — > B(e y B(y)). The new critical formula 
C belongs to the same e-term as the original formula, hence we obtain (a) 
rk(C) = vk(B*) = ik{e y B(y)), and (b) holds trivially. 

Case (ii): e occurs in B(y) (and perhaps also in s). In this case, B(y) = 
B'(y, e) and the critical formula has the form 

B'(s,e)^B'{s y B'{y,e),e) . 

Then the e-term belonging to this critical formula, e' = e y B'(y, e), contains e 
as a proper subterm and hence is of higher degree than e. Since e is a critical 
e-term of maximal degree among the critical e-terms of maximal rank in it, 
this implies that rk(e') < rk(e). Replacing e by t yields the critical formula 

C = B'(s',t)^B'(s y B'(y,t),t) , 

belonging to the e-term e y B'(y,t). This term has the same rank as e' and 
hence a lower rank than e itself (although it might have a degree higher 
than deg(e)). Hence, rk(C) < r. ■ 

Lemma 14. Suppose EC e \- n E. Letr = rk(-7r) be the maximal rank of critical 
formulas in tt, and let e be a critical e-term of ir of maximal degree among 
the critical e-terms of rank r. Then there is a proof TT e so that EC £ \- ne E 
with rk(7r e ) < r, deg(7r e ,r) < deg(7r, r) and o(ir e ,r) = o(ir,r) — 1. 

PROOF. The e-expression e is of the form e x A(x), and suppose that A(ti) — ► 
A(e), . . . , A(t n ) — ► A(e) are all the critical formulas in 7r belonging to e. For 
each i = 1, . . . , n, we obtain a proof 7Tj of A(ti) — > E as follows: 

1. Replace e everywhere in 7r by U. Every critical formula A(tj) — ► A(e) 
belonging to e thus turns into a formula of the form A(t^) — > A(tj). To 
see this, note that e cannot occur in A(x), for otherwise e = e x ^4(x) 
would be a proper subterm of itself, which is impossible. 

2. Add A(ti) to the axioms. Now every one of the new formulas A(tj) — ► 
^4(ti) is derivable using modus ponens from the tautology 
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3. Apply the deduction theorem to obtain 7Tj. 

We verify that TTi is indeed an EC e -proof with the required properties. In 
the construction of 7Tj, we replaced e by U throughout the proof. Such a 
substitution obviously preserves tautologies. By Lemma it also turns 
critical formulas into critical formulas (belonging, perhaps, to different crit- 
ical e-terms). Lemma El also guarantees that replacing e by t\ everywhere 
does not change the rank of critical formulas, and that it does not change the 
critical e-terms of maximal rank r at all (in particular, it does not increase 
the degree of critical e-terms of rank r). 

We started with critical formulas A(ti) — > A(e), and obtained a proof tt^ 
which does not contain any critical formulas belonging to e. Hence e is 
no longer a critical e-term in 7Tj. The ranks of all other critical formulas 
(and the corresponding critical e-terms) remain unchanged. Thus o(iTi,r) = 
o(ir, r) — 1. 

Secondly, we construct a proof tt' of /\" =1 ->A(ti) — > E as follows: 

1. Add f\ —iA(ti) to the axioms. Now every critical formula A(ti) — > A(e) 
belonging to e is provable using the propositional tautology ^A(ti) — > 
{A(ti) — > A(e)). 

2. Apply the deduction theorem for the propositional calculus to obtain a 
proof it', which contains exactly the same critical formulas as tt except 
those belonging to e. 

Now combine the proofs 7Tj of A(ti) — > E and tt' of -iyl(tj) — > E to get 
the proof iT e of E (using case distinction). 

None of the proofs 7Tj, tt' contain critical formulas belonging to e, and no 
critical e-terms of rank r other than those in tt. Thus rk(7r e ) < r, deg(7r e , r) < 
deg(7r, r), and o(n e ,r) = o(-K,r) — 1 hold. ■ 

Theorem 15 (First Epsilon Theorem). If E is a formula without bound 
variables (no quantifiers, no epsilons) and PC E h E then EC h E. 

Proof. First, use the embedding lemma to obtain tt so that EC e A. The 
theorem then follows from the preceding lemma by induction on r = rk(7r) 
and d = o(TT,r). If r = 0, there are no critical formulas, so there is nothing 
to prove. If r > 0, then d-fold application of the lemma results in a proof tt' 
of rank < r. ■ 

Theorem 16 (Extended First Epsilon Theorem). Suppose E{e\, . . . ,e m ) is 
a quantifier-free formula containing only the E-terms s\, . . . , s m , and 

EC £ I— tt E(si, . . . , s m ) , 
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then there are e-free terms tj (1 < i < n, 1 < j < m) such that 

n 

ECh \/ E(t\,...,tl) 

i=i 

where n < 2^'°°^. 

— 2-cc(7r) 

Corollary 17 (Herbrand's Theorem). If 3xi .. .3x m E(xi, ... ,x m ) is a 
purely existential formula containing only the bound variables x\, . . . , x m , 
and 

PC e \~ w 3xi . . . 3x m E(xi, . . . , x m ) , 
then there are e-free terms i*- (1 < i < n, 1 < j < m) such that 

n 

EC h \J E(t\,... ,? m ) 
i=i 

where n < 2t cc y\ . 

— 2-cc(7r) 

PROOF. Immediate from Theorem llfil using the Embedding Lemma. ■ 

The rest of this section is devoted to the proof of of Theorem 1161 First, 
some additional notation. 

Definition 18. Suppose ir is a proof in EC e . The width wd 7r (e) of ir with 
respect to e is the number of different critical formulas in tt belonging to the 
e-term e. The width wd(-7r, r) of tt with respect to rank r is given by 

wd(7r, r) = max{wd 7r (e) | e of rank r occurs in tt} + 1 . 

Definition 19. Let E(a±, . . . ,a m ) be a formula in L(EC) without bound 
variables, and let s\, . . . , s m be terms in L(EC e ). An V -expansion (of 
E = E(si, . . . , s m )) is a finite disjunction 

E' = E x V • • • V Ei , 

where each Ei = E(s\, . . . , s l m ) for terms Sj (1 < i < I, 1 < j < m). We call 
I the length len(E' , E) of the expansion. 

Proposition 20. Suppose A' is an V -expansion of A and A" is an V- 
expansion of A' . Then A" is also an V -expansion of A, and \en(A",A) < 
len(A",A')-len{A',A). 
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Proof. Obvious. ■ 

Lemma 21. Suppose E{a\, . . . ,a m ) is a formula in L(EC) without bound 
variables and ir is an EC £ -proof of E(s\, . . . , s m ) where s\, . . . , s m are terms 
in L(EC E ). Letr = ik{ir) and let e be a critical e -term of ir of maximal degree 
among the critical e -terms of rank r, and let n = wd 7r (e) be the number of 
critical formulas belonging to e. Then there are terms s*- (0 < i < n + 1, 
1 < j < rn) and a proof ir e with end formula 

E(sl...,s 1 m )V---VE(s n l + \..., S n + 1 ), 

so thatrk(ir e ) < r, deg(7r e ,r) < deg(7r,r), and o(ir e ,r) = o(-7r,r) — 1. Further- 
more cc(7r e ) < cc(7r) ■ (n + 1) and wd(-7r e , r) < wd(-7r, r) • {n+1) < wd(7r, r) 2 . 

Proof. We adapt the construction of 7Tj in Lemma ITU The only difference 
to the previous construction is that when replacing e by ij throughout ir, 
the end- formula E{s\, . . . ,s m ) may change. However, e can only occur in 
si, . . . , s m since E{a±, . . . ,a m ) contains no bound variables and hence no 
e-terms. For each critical formula A(ti) — > A(e) we obtain a proof Hi of 
A{ti) — > E{s\, . . . , s l m ). The construction of ir' as before yields a proof of 

n 

f\^A{t i )^E{s^ 1 ,...,s^+ 1 ), 

i=i 

if we take s"" +1 = Sj. Then, since obviously for each i 

n+1 

E{s\,..., S i m )^ \J E{s\,...,s i m ), 



is provable, we obtain a proof ir e of \/™^ E(s\, . . . , s l m ) with the desired 
properties. Observe that the length of the V-expansion V E(s\, . . . , s l m ) is 
n + 1 = wd 7r (e) + 1 < wd(7r, r). 

It remains to verify the bounds on cc(-7r e ) and wd(7r e ,r). By Lemma ITTA 
replacing e by ti to obtain iri does not introduce new critical e-terms of 
rank r. (Critical formulas belonging to e-terms of rk(e) may be altered, but 
the corresponding critical e-terms remain the same.) New critical e-terms 
can only appear at a rank < rk(e), and if they do, their rank is equal to 
the rank of a some critical e-term already in ir. The total number of critical 
formulas in 7Tj is at most that of ir less the number n of critical formulas 
belonging to e, i.e., cc(-7Tj) < cc(ir)—n. Moreover, obviously cc(7r') < cc(ir)—n 
holds. 
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When we combine the n + 1 proofs Hi and ir' to obtain ir e , the worst case 
is that every critical formula in Hi has been changed. Thus cc(7r e ) < (cc(7r) — 
n)(n + 1) < cc(-7r)(n + 1). Now looking more closely at the critical formulas 
of rank r in 7Tj, we see that whenever case (i) in the proof of Lemma 1131 
applies, a critical formula belonging to some e-term e' of rank r in ir turns 
into a potentially new critical formula in 7Tj also belonging to e'. However, 
these are the only new critical formulas belonging to e'. Hence, there may be 
up to wd 7r (e / ) • (n + 1) different critical formulas belonging to e' in ir e . Thus 
wd(7r e ,r) < wd(7r, r) • (n + 1), which is < wd(7r,r) 2 since n + 1 = wd 7r (e) + l < 
wd(7r,r). ■ 



We now iterate the elimination of e-terms of highest rank and estimate 
the critical count of the proof resulting from the elimination of all e-terms 
of rank rk(e). 

Lemma 22. Suppose E(a\, . . . , a m ) is a formula in L(EC) without bound 
variables and ir is an EC £ -proof of E(s\, . . . , s m ), where s\, . . . , s m are terms 
in L(EC e ). Then there is a proof a of an V -expansion E' of E(s\, . . . , s m ), 
so that rk(cr) < rk(7r). Furthermore, 

cc(a) < 2 22 ccW and len(E' , E( Sl , s m )) < . 

Proof. Let d = o(ir,r) and let e%, . . . , be all critical e-terms of rank r 
in 7T. We assume the sequence e\, . . . , is ordered so that the degree never 
increases. Let k = cc(tt) and r = rk(-/r). As observed in the preceding proof, 
an application of Lemma cannot increase the number of critical e-terms 
of maximal rank. Thus let a = 7T and a 3 = cr e . for j > 0. We thus 
obtain a = a d by (i-fold iteration of Lemma l2*Tl Let E° = E(s\, . . . ,s m ). 
By construction, the critical e-terms of rank r in a 3 are e,-, and 
the end- formula E 3 of a 3 is an V-expansion of E = E(s\, . . . , s m ); we set 
E' = E d . 

By induction on j we prove: 

wd(crV) < k 2j , 

cc(a j ) < k ■ k^'=° 2,1 , 
len(E 3 ,E) < k^ 2 ' . 

For j = 0, we have wd(<r°,r) = wd(7r,r) < k, cc(a°) = cc(tt) = k and 
\en(E°,E(si, . . . , s m )) = 1, by definition. 
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Now assume that a 3 obeys the stated bounds, we prove that <j 3+1 does 
as well. Apply Lemma """Tl to eliminate the e-term ej+i. This yields a proof 
a 3+l of BP + . By Lemma I2T1 and the induction hypothesis we have: 

wd(<J J ' +1 ,r) < wd{a 3 ,r) 2 < (k 2 ') 2 = k 2J+1 , 

cc{a j+1 ) < (k ■ k^i=o 2 ' )-k 23 =k- k^t=o 2 ' , and 
len(^ +1 , E) < (k^=o 21 ) • k 23 = hPL, 21 . 

since wd CT j(ej+i) + 1 < wd(a 3 \r) < k 2J . Thus the claim follows and we 
obtain 

cc(cr) < k ■ k^i=o 2 ' = k ■ k 2d ~ x = k 2<i and 
len(E',E) < k^to * = k 2 "' 1 . 



The order d = o(ir, r) is the number of critical e-terms of rank r, and hence 
< k. Using the inequality k < 2 k we obtain the (rough) upper bounds 
cc(ct) < k 2d < 2 22k and \en{E',E) < k 2 '' 1 < 2 2 ™ . ■ 



Proof of Extended First Epsilon Theorem [TBI Consider a proof ir 
of E(si, . . . , s m ), where s\, . . . , s m are terms containing e's and E{a\, . . . , a m ) 
contains no bound variables. Let k = cc(tt) and p be the number of different 
ranks of critical e-terms in it, i.e., p = \{r : wd(-7r,r) > 1}|. The number p 
is the number of times we have to apply Lemma f""""l to eliminate all critical 
formulas from tt. (Note that by the proof of Lemma [""""] each elimination 
step can only decrease the number of different ranks.) Although obviously 
p < r = rk("7r) we also have p < k = cc(ir), so the number of times Lemma l22l 
must be applied is actually independent of rk(7r) . 

Now let 7T° = 7r and tt 3+1 be the proof a constructed in Lemma l"""""l starting 
with tt 3 . Note that the end- formula of each tt 3 is an V-expansion of E. If 
we write E 3 for the end- formula of tt 3 , then E p is the required Herbrand 
disjunction 

n 

V^(4,...,C)- (2) 

i=i 

To establish a bound on the length n of ([""jl. we apply Lemma 122*1 (p — 1) 
times. This yields the following bounds: 

cc(vO < 2f+X) 1) ^d len(E p -i, E) < 2f+^ . 
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Another application of Lemma [22] yields that 

n < len(E p , Ep^i) ■ len(E p ^i, E) 
< 2 2 ■len(.Ep_ 1 ,S) 

/ 2 fc + (r-l)\ 

^ ^IV-i) I 2fc+(p-l) 
- ^ ' Z 2(p-1) 

^ 2 2 (P" 1 ) _ r>2£:+p . 3fc 
^ z — z 2p — Z 2fc • 

As a last step, we remove the remaining (non-critical) e-terms from the 
proof by replacing outermost e-terms by free variables. Clearly, this cannot 
increase the length n of (J2J). ■ 



6. Lower Bounds on Herbrand Disjunctions 

As noted in the proof of Theorem 1161 the bound on the length of the Her- 
brand disjunction depends only on the critical count of the initial proof. This 
is in contrast to the bound we would obtain by the more standard approach 
of cut-elimination and the mid-sequent theorem which depends on the length 
and cut complexity of the original proof (see, e.g., 0,0). In the case of 
the e-calculus, the result concerns the relation between the critical count of a 
proof of 3x E(x) in PC e and the length of a Herbrand disjunction \J E(ti). In 
the case of the sequent calculus and cut-elimination the result concerns the 
relation between the length and cut complexity of a proof with cut, and the 
length of a cut-free proof, which in turn determines the length of a Herbrand 
disjunction obtained via the mid-sequent theorem. In both cases, the rela- 
tionship is hyperexponential. Statman j^] and Orevkov [2]J showed that 
this bound is not just an artefact of the particular cut-elimination proce- 
dure considered, but that proofs with cut essentially have hyper-exponential 
speedup over cut-free proofs. The question may then be raised whether the 
same holds true of the e-calculus, i.e., whether the bound on the length of 
Herbrand disjunctions obtained in the first e-theorem is tight. Although we 
do not have a result quite as optimal as Orevkov's in this regard, it can be 
shown that every e-elimination procedure that yields Herbrand disjunctions 
must by hyperexponential. 

We sketch the proof of such a lower bound theorem for the length of 
Herbrand disjunctions. Recall that the Herbrand complexity HC(E) of a 
purely existential formula E = 3x± . . . 3x n E'(xi, . . . , x n ) is the length of the 
shortest V-expansion of E'(x±, . . . , x n ). 

Theorem 23. There is a sequence of formulas E^ so that 
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1. for each k, there is a PC e -proof 7Tk of E\- with cc(iTk) < c- k (for some 
constant c), but 

2. HC(£ fc ) > 2\. 

We follow the presentation of Orevkov's Theorem in j^, §6.11]. (Stat- 
man's result requires equality, but Orevkov's does not.) Consider a language 
including a unary constant 0, a unary function symbol 5 and a ternary re- 
lation R, whose meaning is fixed by the following axioms: 

Hypi = Vx R(x, 0, S(x)) , 

Hyp 2 = s iyixizizx(R(y,x,z) A R(z,x,zi) ->• R(y , S '(s) , z{)) . 

Further, we define 

C fc = . . . 3zq(R(0 1 0, Zk) A R(0, z^, Zk-i) A • • • A R(0, zi, Zq)) . 

R(n, m, k) expresses that n + 2 m = k, and expresses that l\ is defined. 
Ek is the (purely existential) prefix form of Hypi A Hyp 2 — > C\~. 

Lemma 24. For every k, PC e Ej., where cc(7Tfc) = c • k (for some con- 
stant c). 

Proof. is provable in the sequent calculus (alternativ ely, in natural 
deduction) using proofs (with cut) of length linear in k, see |23j |. Proofs in 
the sequent calculus and in natural deduction can be translated into proofs 
in PC £ with linear increase in proof length. Moreover, as in the embedding 
lemma, only weak quantifier inferences (31, VE) increase the critical count 
of the PC e -proof. (We omit the details, which are routine.) ■ 

This establishes part (1) of the theorem. Orevkov's result concerns proof 
lengths; we have to adapt the proof to Herbrand complexity. We give a di- 
rect proof of a lower bound on HC(_Efc); the result can also be obtained using 
techniques from proof complexity as in 0] . In order to simplify the presen- 
tation, we will consider Herbrand sequents of Hyp 1 ,Hyp 2 => Ck instead of 
Herbrand disjunctions, i.e., valid sequents of the form ri,r 2 => A where 
each formula in T\ is a substitution instance of R(x, 0, S(x)), each formula 
in T 2 is a substitution instance of R(y,x,z) A R(z,x,z\) — > R(y,S(x),z\), 
and each formula in A is one of R(0, 0, Zk) A i?(0, z^, Zk-x) A • • • Ai?(0, z%, zq). 
Then obviously max{|ri|, |r 2 [, |A|} < HC(E}~). In the following, n abbrevi- 
ates S n {0), and * = {Hy Pl ,Hyp 2 }. 
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Lemma 25. Suppose ^> =>■ R(n, m, I) is valid. Then I = n + 2 m and for each 
Herbrand sequent T = (Ti,r2 => R(n,rh,l)) of \& =>■ R(n,m,l), we have 

{R(i, 0, 5(i)) : n < i < n + 2 m } C I?i . 

In particular, \T\ \ > 2 m . 

Proof. If m = 0, then clearly the only possibility is I = n + 1. Then any 
Herbrand sequent of \P => i?(n, 0, S(fi)) can be written as R(n, 0, S(n)), V => 
i?(n, 0, 5(n)) and satisfies the conditions. 

Suppose the result is established for m, and consider the case for m + 1. 
Let Li,L2 =4> R(n, S(fh),l) be any Herbrand sequent of i?(n, S(fh),l) 
with Li the instances corresponding to Hyp! and r 2 those corresponding 
to Hyp 2 . As R(n, S(m),l) cannot follow from instances of R(x,0, S(x)) 
alone, r 2 is nonempty and must contain a formula of the form 

R(n, fh, k) A R(k, fh, I) — > R(n, S(fh),l) , 

such that T\ = (ri,T2 R(h,fh,k)) and T 2 = (ri,T 2 => R(k,fh,l)) are 
both valid. That means that Ti is a Herbrand sequent of \£ i?(n, m, fc) 
and T 2 one of =>■ R(k,fh,l). The induction hypothesis applies, and it 
follows that fc = n + 2 m and / = k + 2 m , thus / = n + 2 m+1 . Further, T x 
must contain 

0, S(i)) :n<i<n + 2 m }U {R(%, 0, 5(1)) : n + 2 m < i < n + 2 m+1 } , 

and the lemma follows. ■ 

Lemma 26. Let S be a sequent of the form ^> =>■ 3zA(z). Then every 
minimal Herbrand sequent of S is of the form T => A with |A| = 1. 

Proof. We use of the terminology and results of Chapter XI of [l3 |. Sup- 
pose that T = T =>■ A is a Herbrand sequent of S with A = A(ti), . . . , A(i n ). 
Each formula in T is Horn. Thus the term model 3 r is a free model of 
L (Corollary 2.5 of Q). Since r => A is valid and 3 r |= T, 3 r |= 
A(ti) V ... V A(i n ). Then there is an i so that 3 r |= But 3 r is 

free. Hence, every model of L is also a model of and L => is a 

Herbrand sequent of S. ■ 

Lemma 27. IfT = (ri,T 2 =4> A) is a minimal Herbrand sequent ofty =4> C^, 
then \Yi\ > 2\. 
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PROOF. By Lemma l26l T is of the form 



r r 2 => R{0, 0, ft*) A R(0, fi k , n k -i) A • • • A R(0, ni, n ) ■ 



(3) 



(Note that by substituting for free variables, terms in a Herbrand sequent 
may always be brought into that form). As (JHJ) is valid, each of the sequents 
Ti,r2 => i2(0, 0, n&), Ti,r2 => i?(0, nx,no) is valid as well. Applying 
Lemma OKI (k — l)-times, we see that m = 2jf,_ 1 . Since Ti, T 2 =>• i?(0, ni, no) 
is a Herbrand sequent of \& =4* i?(0, ni, no), Ti contains the instances of Hyp x 
given in Lemma l25l and no = 2 ni = 2\ . Hence, \T\ > 2\. ■ 

7. The Second Epsilon Theorem 

The Second Epsilon Theorem is a generalization of the first. It states that 
a formula without e-terms provable in the extended predicate calculus is al- 
ready provable in the predicate calculus (without e-terms). Its proof utilizes 
no additional methods specific to the e-calculus beyond those of the first 
e-theorem. 

Definition 28. Suppose A = Q\xi . . . Q n x n B(x\, . . . , x n ) is a prenex for- 
mula. Let z%, . . . , Zi be all the V-quantified variables among x%, . . . , x n , let 
j/i, j/ m be all the 3-quantified ones, and let /i, . . . , // be new function 
symbols. The Herbrand normal form A H of A is 

3yi . . . 3y m C(yi, . . . ,y m ,h, . . . ,t{) , 

where tj = fj(y t , ... ,y m ). 

Lemma 29. Suppose PC £ h A. Then PC £ h A H . 

Proof. Standard. ■ 

Theorem 30 (Second Epsilon Theorem). If A is a formula o/L(PC) and 
PC e h A, then PC h A. 

Proof. For simplicity, we give the proof for prenex formula A with a sim- 
ple quantifier structure. The general results follows similarly. Assume A 
has the form 3x\/y3z B(x,y, z) with B(x,y,z) quantifier-free and only the 
indicated variables occur in A. We apply Lemma [2^1 to obtain a proof of 
3x3z B(x, f(x), z). The extended first e-theorem now yields that there are 
e-free terms rj, S{ so that 




(4) 
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The idea is now to replace the /(r,) by new free variables a% and obtain 
from (@J), that 

is deducible in EC. Then the original prenex formula A can be obtained if 
we employ suitable quantifier-shifting rules (deducible in PC). 

Let /(n), . . . ,f(r p ) denote terms occurring in the disjunction Q). Let 
Pi be the number of occurrences of / in f(ri). We may assume that the 
disjunction is arranged so that that the sequence f(ri), . . . , f(r p ) is ordered 
such that pi < Pi+i- Now let a±, . . . , a p be new free variables. Replace each 
occurrence of f{ri) which does not occur as a subterm of another f(rj) by 
a, L . Then becomes 

\j 'S(^,Oi,s-) , (5) 

i 

Observe that r[ does not contain a,j for j > i. For if did contain a,j, then 
ri must contain f(rj), and pj < pi. But we assumed that the disjunctions 
were ordered so that the sequence of pi was non-decreasing. 

It is easy to see that © is also a tautology, since pairs of equal atomic 
formulas remain pairs of equal atomic formulas. Thus from Q we obtain 
that 

yizBfaoi^), (6) 

i 

by existentially generalizing on the terms s[. Now consider the last disjunct 
in Q. By the preceding observation, a p does not occur in any other disjunct, 
or in r' p . Hence, in PC, we may deduce from 

p-i 

V 3z B ( r i' a *> Z ) V ^ Z B ( r pi °P' Z ) ' 
i=l 

the formula 

p-i 

V BzB^Oi,*) \Z\/y3zB(r' p ,y,z) . 
i=i 

Iterating these steps we eventually obtain a proof of A in PC. ■ 
8. Conclusion and Further Work 

The above proofs of the first and second e-theorem were formulated for 
theorems of PC £ . However, as indicated in the introduction, the theorems 
remain valid in the presence of open (quantifier- and e-free) theories. 
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Corollary 31. Let Ax be a set of formulas without bound variables. 

1. Let E be a formula without bound variables (no quantifiers, no ep- 
silons). If Ax h E in PC £; then Ax h E in EC, 

2. Let 3xE(x) be a purely existential formula. If Ax h 3xE(x) in PC £ , 
then Ax h \J i E(tn, . . . , t; Lri ) for some e-free terms Uj in EC 

3. If E is an e-free formula and Ax h E in PC £ , then Ax h E in PC. 

The discussion of the e-calculus given here is only a first step toward 
a more comprehensive investigation of Hilbert's e-calculus. The gap in the 
upper and lower bound for the Herbrand complexity of theorems of EC e 
suggests that a stricter analysis or a refinement of the elimination procedure 
for the first e-theorem is possible. A more interesting and pressing question, 
however, is the analysis of e-elimination procedures for the e-calculus with 
equality. The addition of equality to the e-calculus is not as straightforward 
as it is in the predicate calculus, and the first e-theorem is significantly more 
complicated if equality is present than when it is not. It remains a topic for 
future work. 

In the introduction we claimed that encoding of quantifiers on the term 
level using the e-operator may allow for a more condensed representation 
of proofs. Let us briefly sketch the reason for this. Since modus ponens is 
the only inference rule in EC e , a formula A £ is provable in EC £ iff there is a 
tautology of the form 



Thus it suffices to find the critical formulas Bi(tj) — > Bi(e x Bi(x)), i.e., the 
substitutions involved in the proof of A, such that (O is a tautology. This 
suggests that the formalization of proofs is simpler in the e-calculus or at 
least that proofs in the e-calculus can be represented more succinctly. 

As pointed out above, the bound on the length of the Herbrand disjunc- 
tions obtained using the first e-theorem depends only on the critical count 
of the initial proof. (If equality is present, however, the maximal rank of 
critical formulas will also play a role.) In other systems, such as the sequent 
calculus, the number of critical formulas corresponds to the number of weak 
quantifier inferences. Standard methods for obtaining bounds on Herbrand 
disjunctions ordinarily do not yield a bound only in the number of weak 
quantifier inferences. Consequently, the result obtained above is of inde- 
pendent interest. The change of input parameters is especially significant 




(7) 
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when considered in conjunction with the above remarks on formalizability. 
Standard methods usually only yield specific information about Herbrand 
disjunctions — such as their length — if a complete formal proof is available. 
Within the e-calculus, we may weaken this assumption, as provability wit- 
nessed by a tautology of the form of (J7J) suffices. This fact was successfully 
employed by Kreisel in his "unwinding" of the proof of Littlewood's theo- 
rem |15i. 
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